Safeguard in VS Code, Cursor and JetBrains: what you see while you code

The cheapest time to fix a vulnerable dependency is before you commit it. The Safeguard IDE extensions bring security insight into the editor, so a risky package shows up as you add it and not three weeks later in a report.

There are two codebases: one extension for VS Code and Cursor, and a separate plugin for JetBrains IDEs. They are versioned independently, so features differ slightly. This post says where.

What it is

Both scan your dependency manifests as you work, show vulnerabilities inline and offer fixes without leaving the editor. Distribution:

Supported manifests include package.json and lockfiles for npm, Yarn and pnpm, requirements.txt, pyproject.toml and Pipfile for Python, pom.xml and Gradle files for the JVM, go.mod and go.sum, Cargo.toml and Cargo.lock, and Gemfile and Gemfile.lock.

How to use it

Install

For VS Code:

code --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension

For Cursor, which installs from Open VSX:

cursor --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension

You can also open the Extensions view, search for Safeguard and click Install. In a JetBrains IDE, open Settings, then Plugins, search for Safeguard, install it and restart the IDE.

Sign in

Both use an OAuth device flow. Run the Safeguard: Login command, which opens a page at app.safeguard.sh/activate with a verification code. Approve it, return to the IDE, and your tenant is filled in for you. In JetBrains the entry is under Tools, then Safeguard, then Login.

Scanning public packages works without logging in. Some features that need the backend, such as backend-verified package checks, need you to be signed in.

What you will see

• Inline warnings. A flagged dependency is marked in the manifest. Hover for a summary and a quick fix.
• Scan on save. Auto scan and scan on save are on by default. You can also scan on demand with Safeguard: Scan Project for Vulnerabilities.
• A results view. In VS Code and Cursor, the Safeguard view has Vulnerabilities, SBOM, Compliance and Recommendations panels. In JetBrains, a tool window shows a tree of vulnerabilities.
• Fix suggestions. Choose a remediation strategy: Safe (minor updates only), Balanced (minor and patch, the default) or Aggressive (latest available).

Differences to know about

In JetBrains, put the cursor on a flagged dependency, press Alt+Enter and choose Fix with Safeguard AI. You can review the change in the diff view before applying.

Pin the stricter package check

In VS Code and Cursor, an inline check runs when you add a dependency. By default it uses an offline local heuristic. To require backend-verified results, which need a sign-in, add this to settings.json:

{
  "safeguard.enablePackageFirewall": true,
  "safeguard.packageFirewallUseBackend": true
}

Try it yourself

Open a project with a package.json or requirements.txt, install the extension and sign in. Add a deliberately old version of a popular package, save, and look at the inline warning. Hover over it, then use the quick fix with the Safe strategy and read the diff before you accept it.

Want to see how a gate at the editor works before you install? Click through the demo.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• IDE support documentation
• Safeguard documentation home